GABRIEL SCHOENFELD: A REVIEW OF “COUNTDOWN TO ZERO DAY” BY KIM ZETTER ****
http://online.wsj.com/articles/book-review-countdown-to-zero-day-by-kim-zetter-1416181493
Iran is racing forward with its nuclear-bomb making effort. The Obama administration is racing forward with its effort to get the ayatollahs to sign a piece of paper promising peace in our time. The only thing Secretary of State Kerry’s diplomacy is missing these days is the same kind of hat that Neville Chamberlain held in his hand as he met with Herr Hitler in Munich and begged him to be reasonable.
What alternatives exist for stopping Iran from obtaining a nuclear weapon? Several years ago, U.S. and Israeli intelligence attempted to derail Iranian nuclear progress by introducing the Stuxnet virus into Iran’s uranium processing facility at Natanz. If the operation’s objective was to stop Iran in its nuclear tracks, it failed. But it might have temporarily slowed the Iranians down. A fascinating new book, Countdown to Zero Day, has assembled what is known about the cyber-attack. You can read my review of it in the Wall Street Journal . G.S.
Hacking the Ayatollahs
The Stuxnet virus opened and closed valves on Iranian centrifuges and adjusted their power supply as false readings were fed to operators.
In early 2010, inspectors from the International Atomic Energy Agency noticed a problem at Iran’s nuclear facility at Natanz, Iran. The centrifuges employed to separate enriched uranium—the precursor to bomb-grade material—from uranium hexafluoride gas were breaking down at a startling rate. What the inspectors did not know was that the facility was under attack by Stuxnet, a computer virus designed by American and Israeli intelligence agencies under the code name Operation Olympic Games. “Countdown to Zero Day” by Kim Zetter, a reporter for the technology magazine Wired, gives a full account of this “hack of the century,” as the operation has been called. Exhaustively researched, the book goes well beyond its ostensible subject to offer a hair-raising introduction to the age of cyber warfare.
Countdown to Zero Day
By Kim Zetter
(Crown, 433 pages, $25
Among much else, Ms. Zetter chronicles just how the world came to learn of Stuxnet. Obscure computer-security firms in locations like Belarus and Slovakia first detected the virus in 2010. Before long, it began appearing on thousands of computers world-wide, and powerhouses like the antivirus software firm Symantec set to work trying to solve the riddle posed by the mysterious code.
Conventional viruses aim to steal passwords or accomplish some other criminal purpose. Stuxnet was different. Despite its complexity, it appeared to do nothing at all beyond attempting to spread and replicate itself. After the digital sleuthing of far-flung investigators, it emerged that the code was narrowly tailored to come to life only when it encountered certain industrial-control devices containing proprietary software produced by the German firm Siemens. The devices running that software were installed in only one location: the heavily fortified Iranian facility in Natanz.
The first thing Stuxnet did upon invading a computer was to “phone home”—i.e., send a signal to a server (based in Malaysia) that operated as its command post. The signal reported key details about the computer, such as where it was located, what its IP address was and, critically, whether it contained the Siemens software. If it did not, the virus became inert—end of story. If the virus hit pay dirt, the fun began.
The fun seems to have included opening and closing valves on Iranian centrifuges and adjusting their power supply. The objective was to cause pressure to build up to dangerous levels and force the precious uranium gas into a “dump line,” where it went to waste. At the same time, the virus fed false normal readings to the Iranian operators, who were left clueless as their interlinked centrifuges quietly went haywire. Ms. Zetter suggests that Stuxnet might have also altered spin speeds, leading centrifuges to wobble, break free from their moorings and fly apart, not so quietly destroying entire production chains.
Ms. Zetter marshals evidence suggesting that these high jinks slowed down Iran’s nuclear effort. It is not a criticism of her book to note that this assessment, like many of its observations and conclusions, is at best well-informed conjecture. Operation Olympic Games remains shrouded in secrecy. The interviews and public sources upon which Ms. Zetter draws yield no definitive information. Perhaps only the Iranians themselves know for certain what happened, and they are not telling.
Whatever Stuxnet did or did not accomplish, “Countdown to Zero Day” has the virtue of putting the attack into a broader context. The epoch of cyber warfare inaugurated by Stuxnet promises to be no less unnerving than the nuclear-weapons age that began in 1945. The problem is familiar: What goes around comes around. We may hope that the virus damaged the ayatollahs’ nuclear program, but given the degree to which Internet connectivity has expanded into every corner of American life, we ourselves are susceptible to attack by the same kind of stealth weapon.
Though recent headlines have focused on the cyber-penetration of retail outlets, financial institutions and government systems, Ms. Zetter reminds us that our physical infrastructure is vulnerable as well. In 1997 a teenager hacked into a Bell Atlantic computer system and for six hours turned off the runway lights and crippled the control tower of the Worcester, Mass., airport. In 2000 in Australia, a disgruntled former employee of a water-treatment firm evaded safeguards to cause 750,000 gallons of raw sewage to pour into public waterways. In 2003 the SoBig virus attacked train-signaling equipment on the Eastern Seaboard and brought rail traffic to a halt. That same year, the Slammer worm disabled critical safety systems at the Davis-Besse nuclear power plant in Ohio.
If individuals or small groups of amateurs can perpetrate attacks of this magnitude, imagine what nation-states might do. With the advent of Stuxnet, state-sponsored attacks are no longer hypothetical. In military and intelligence establishments the world over, the race is on to find the exploitable security holes in widely used software—called “zero days” because programmers have had zero time to plug the holes—that make cyber warfare a mounting threat.
What can we do to better guard against the dire possibilities that may lie ahead? Advocates of arms control call for a treaty that would limit or abolish digital warfare. But if it has been difficult to verify treaty compliance with physical weapons, doing so with intangible computer code may be well-nigh impossible. Noting the “obvious problems” with the treaty approach, Ms. Zetter is rightly dismissive of it, but she does not suggest an alternative. The reason may be that there is none. In the cyber battle ahead, the only true winners may be the hackers and computer engineers who increasingly hold our future in their hands.
Mr. Schoenfeld, a senior fellow at the Hudson Institute, is the author of “Necessary Secrets: National Security, the Media, and the Rule of Law.”
Comments are closed.
